The flowadm command is used to create, modify, remove, and show networking bandwidth and associated resources for a type of traffic on a particular link.

The flowadm command allows users to manage networking bandwidth resources for a transport, service, or a subnet. The service is specified as a combination of transport and local port. The subnet is specified by its IP address and subnet mask. The command can be used on any type of data link, including physical links, virtual NICs, and link aggregations.

A flow is defined as a set of attributes based on Layer 3 and Layer 4 headers, which can be used to identify a protocol, service, or a virtual machine. When a flow is identified based on flow attributes, separate kernel resources including layer 2, 3, and 4 queues, their processing threads, and other resources are uniquely created for it, such that other traffic has minimal or zero impact on it.

Inbound and outbound packet are matched to flows in a very fast and scalable way, so that limits can be enforced with minimal performance impact.

The flowadm command can be used to identify a flow without imposing any bandwidth resource control. This would result in the traffic type getting its own resources and queues so that it is isolated from rest of the networking traffic for more observable and deterministic behavior.

flowadm is implemented as a set of subcommands with corresponding options. Options are described in the context of each subcommand.

Show flow configuration information (the default) or statistics, either for all flows, all flows on a link, or for the specified flow.

-o field[,...]

A case-insensitive, comma-separated list of output fields to display. The field name must be one of the fields listed below, or a special value all, to display all fields. For each flow found, the following fields can be displayed:

flow

The name of the flow.

link

The name of the link the flow is on.

ipaddr

IP address of the flow. This can be either local or remote depending on how the flow was defined.

transport

The name of the layer for protocol to be used.

port

Local port of service for flow.

dsfield

Differentiated services value for flow and mask used withDSFIELD value to state the bits of interest in the differentiated services field of the IP header.

-p, --parsable

Display using a stable machine-parsable format.

-P, --persistent

Display persistent flow property information.

-S, --continuous

Continuously display network utilization by flow in a manner similar to the way that prstat(1M) displays CPU utilization by process.

-s, --statistics

Displays flow statistics.

-i interval, --interval=interval

Used with the -s option to specify an interval, in seconds, at which statistics should be displayed. If this option is not specified, statistics are displayed once.

-l link, --link=link | flow

Display information for all flows on the named link or information for the named flow.

Adds a flow to the system. The flow is identified by its flow attributes and properties.

As part of identifying a particular flow, its bandwidth resource can be limited and its relative priority to other traffic can be specified. If no bandwidth limit or priority is specified, the traffic still gets its unique layer 2, 3, and 4 queues and processing threads, including NIC hardware resources (when supported), so that the selected traffic can be separated from others and can flow with minimal impact from other traffic.

-t, --temporary

The changes are temporary and will not persist across reboots. Persistence is the default.

If a link is specified, remove all flows from that link. If a single flow is specified, remove only that flow.

flowadm set-flowprop [-t] [-R root-dir] -p prop=value[,...] flow

Set values of one or more properties on the flow specified by name. The complete list of properties can be retrieved using the show-flow subcommand.

-t, --temporary

The changes are temporary and will not persist across reboots. Persistence is the default.

-R root-dir, --root-dir=root-dir

Specifies an alternate root directory where flowadm should apply persistent setting of properties.

-p prop=value[,...], --prop=value[,...]

A comma-separated list of properties to be set to the specified values.

flowadm reset-flowprop [-t] [-R root-dir] -p [prop=value[,...]] flow

Resets one or more properties to their default values on the specified flow. If no properties are specified, all properties are reset. See the show-flowprop subcommand for a description of properties, which includes their default values.

-t, --temporary

Specifies that the resets are temporary. Temporary resets last until the next reboot.

-R root-dir, --root-dir=root-dir

Specifies an alternate root directory where flowadm should apply persistent setting of properties.

-p prop=value[,...], --prop=value[,...]

A comma-separated list of properties to be reset.

flowadm show-flowprop [-cP] [-l link] [-p prop[,...]] [flow]

Show the current or persistent values of one or more properties, either for all flows, flows on a specified link, or for the specified flow.

By default, current values are shown. If no properties are specified, all available flow properties are displayed. For each property, the following fields are displayed:

FLOW

The name of the flow.

PROPERTY

The name of the property.

VALUE

The current (or persistent) property value. The value is shown as-- (double hyphen), if it is not set, and ? (question mark), if the value is unknown. Persistent values that are not set or have been reset will be shown as -- and will use the system DEFAULT value (if any).

DEFAULT

The default value of the property. If the property has no default value, -- (double hyphen), is shown.

POSSIBLE

A comma-separated list of the values the property can have. If the values span a numeric range, the minimum and maximum values might be shown as shorthand. If the possible values are unknown or unbounded, -- (double hyphen), is shown.

Flow properties are documented in the "Flow Properties" section, below.

Show the historical network flow usage from a stored extended accounting file. Configuration and enabling of network accounting through acctadm(1M) is required. The default output will be the summary of flow usage for the entire period of time in which extended accounting was enabled.

-a

Display all historical network usage for the specified period of time during which extended accounting is enabled. This includes the usage information for the flows that have already been deleted.

-d

Display the dates for which there is logging information. The date is in the format DD/MM/YYYY.

-F format

Specifies the format of plotfile that is specified by the -p option. As of this release, gnuplot is the only supported format.

-p plotfile

When specified with -s or -e (or both), outputs flow usage data to a file of the format specified by the -F option, which is required.

-s time, -e time

Start and stop times for data display. Time is in the formatYYYY.MM.DD,hh:mm:ss.

-f filename

Read extended accounting records of network flow usage fromfilename.

flow

If specified, display the network flow usage only from the named flow. Otherwise, display network usage from all flows.

The flow operand that identify a flow in a flowadm command is a comma- separated list of one or more keyword, value pairs from the list below.

local_ip[/prefix_len]

Identifies a network flow by the local IP address. value must be a IPv4 address in dotted-decimal notation or an IPv6 address in colon- separated notation. prefix_len is optional.

If prefix_len is specified, it describes the netmask for a subnet address, following the same notation convention of ifconfig(1M) androute(1M) addresses. If unspecified, the given IP address will be considered as a host address for which the default prefix length for a IPv4 address is /32 and for IPv6 is /128.

remote_ip[/prefix_len]

Identifies a network flow by the remote IP address. The syntax is the same as local_ip attributes

transport={tcp|udp|sctp|icmp|icmpv6}

Identifies a layer 4 protocol to be used. It is typically used in combination with local_port to identify the service that needs special attention.

The optional dsfield_mask is used to state the bits of interest in the differentiated services field when comparing with the dsfield value. A 0 in a bit position indicates that the bit value needs to be ignored and a 1 indicates otherwise. The mask can range from 0x01 to0xff. If dsfield_mask is not specified, the default mask 0xff is used. Both the dsfield value and mask must be in hexadecimal.

The following flow properties are supported. Note that the ability to set a given property to a given value depends on the driver and hardware.

maxbw

Sets the full duplex bandwidth for the flow. The bandwidth is specified as an integer with one of the scale suffixes(K, M, or G for Kbps, Mbps, and Gbps). If no units are specified, the input value will be read as Mbps. The default is no bandwidth limit.

priority

Sets the relative priority for the flow. The value can be given as one of the tokens high, medium, or low. The default is medium.

The command below creates a policy around inbound HTTPS traffic on an HTTPS server so that HTTPS obtains dedicated NIC hardware and kernel TCP/IP resources. The name specified, https-1, can be used later to modify or delete the policy.

The following command sets a policy for EF PHB (DSCP value of 101110 from RFC 2598) with a bandwidth of 500 Mbps and a high priority. The dsfield value for this flow will be 0x2e (101110) with the dsfield_mask being0xfc (because we want to ignore the 2 least significant bits).